Privacy Policy

Last updated: October 16, 2026.

Who we are

Tobby is a video, live streaming and battles app operated by Tobby Inc. (Florida, United States), the controller of your data ("we", "us").

• Privacy contact: tby@tobby.live (subject "Privacy"). We reply within 1 month.
• EU representative (Art. 27 GDPR): being appointed; in the meantime, email us at tby@tobby.live.
• UK representative (Art. 27 UK GDPR): being appointed; in the meantime, email us at tby@tobby.live.

What data we store

• Account: email, name, @username, city (if you add it), photo, bio, date of birth (to check you are 18 or older; never shown to anyone), and whether you signed in with Apple or Google.
• What you upload: videos, photos, stories, comments, messages, products and reviews.
• Activity: who you follow, your fires (likes), saved items, gifts you send and receive, battles, blocks and reports.
• Purchases: if the shop is active, the shipping address and the order status. Card details are handled by Stripe; we do not see them.
• Device: the token used to send you notifications and the language of your phone.
• Coins: how many coins you have, what you buy and gifts. If you sell or get paid in the app: the tax data the law requires (see below).
• Safety: reports, moderation decisions and appeals. On our web forms (no account needed) we keep a one-way hash of your IP address for one hour to stop abuse, never the IP itself.

Why we use it and our legal basis

• Providing the service (account, profile, videos, live streams, chat, gifts, coins, shop, notifications, translations and captions you request): necessary for the contract you accept by using the app (Art. 6(1)(b) GDPR).
• Checking your age (date of birth) and protecting minors: legal obligation and our legitimate interest in keeping the app adults-only (Art. 6(1)(c) and (f)).
• Moderation and safety (reports, illegal content notices, account suspensions, stopping spam and fraud): legal obligation (EU Digital Services Act, UK Online Safety Act) and legitimate interest in a safe community (Art. 6(1)(c) and (f)).
• Payments, tax and accounting (including records of what sellers are paid, DAC7): legal obligation (Art. 6(1)(c)).
• Responding to authorities when the law requires it: legal obligation.

We do not sell your data. The app has no ads, builds no advertising profiles and makes no solely automated decisions with significant effects on you: moderation decisions are made by a person.

Who it is shared with (service providers)

• Google Firebase (accounts, data and notifications) — United States.
• Cloudflare (videos, photos and live streams) — United States. Also its artificial intelligence to translate messages and comments when you request it and for automatic captions: a video's audio is only processed if you check "Generate automatic captions" when publishing it.
• DeepAR (face filters): the camera image is processed on your phone to apply the filter; it is not stored and is not used to recognize anyone (we process no biometric data).
• Stripe (shop payments and coin purchases on the web).
• Apple and Google (if you sign in with them or buy coins in their store).

Transfers outside the EU and the UK: these providers are in the United States. We rely on the EU-U.S. Data Privacy Framework (and its UK Extension) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (with the UK Addendum).

How long we keep it

• Your data, for as long as you have an account. When you delete it, it is deleted immediately (see how to delete your account).
• Stories are deleted automatically after 24 hours. Live streams are not recorded.
• Moderation decisions and appeals: up to 1 year after they are closed.
• Payments, orders and sellers' tax data: as long as the law requires (usually 5 to 10 years).

Your rights

You can ask for access, rectification, erasure, portability, restriction and to object (to what we do based on legitimate interest). In the app:

• Download my data: Settings → Download my data. You get a JSON file with your data.
• Delete my account: Settings → Delete my account.
• Change your data: Profile → Edit profile.

For anything else, email tby@tobby.live. We reply within 1 month. You can also complain to the data protection authority in your country (in the UK, the ICO; in Spain, the AEPD).

Age

The app is for adults 18 and older only. We ask for your date of birth when you sign up. If you are a minor, we do not store your date of birth and you cannot use the app; if we find an account belonging to a minor, we close it.

Cookies

Our web pages use no cookies, analytics or advertising, so we do not ask for cookie consent. The app has no advertising trackers; it only stores on your phone what it needs to work (your session, language and settings).

Changes

If we change this policy, we will tell you in the app. More legal information for the EU and the UK: points of contact.

Privacy · Terms · Delete account · Child safety · Support
Español · English · Português · Français · Deutsch · Italiano · العربية · Türkçe · Русский · हिन्दी · Bahasa Indonesia · Tiếng Việt · Filipino · 日本語 · 한국어 · 简体中文